Executive brief
Notepad++ is a text editor used for code development that includes a macro feature to automate repetitive tasks. Prior to version 8.9.8, the application failed to properly validate macro files in the "Run a Macro Multiple Times" dialog, allowing a user with access to modify the configuration to execute arbitrary commands with the privileges of the current user. An attacker who gains access to a user's configuration files could use this to execute malicious programs.
Technical details
The vulnerability is an HMAC validation bypass in the shortcuts.xml macro file handler. The WM_MACRODLGRUNMACRO entry point (Run a Macro Multiple Times dialog) calls macroPlayback() without performing the HMAC validation checks that are applied by the command() function, allowing tampered macros blocked through normal menu/shortcut execution paths to run through the multi-run dialog. An attacker who can modify shortcuts.xml can invoke internal Notepad++ commands that launch external programs.
Affected products
- Notepad++ Notepad++ prior to 8.9.8
Timeline
- 2026-09-22: disclosed
- 2026-08-23: patched